refactor: nix/host-modules + nix/agent-modules layout, update doc paths

docs/tools/bash.md

@@ -2,7 +2,7 @@
 
 Background shell execution via `hive-bash-mcp`. Tools land as
 `mcp__bash__<tool>` (the MCP server name is `bash`, not `hyperhive`).
-Available on every agent unconditionally — `harness-base.nix` always
+Available on every agent unconditionally — `nix/agent-modules/mcp.nix` always
 injects bash into `hyperhive.extraMcpServers` (with `allowedTools =
 ["*"]`), so `mcp__bash__*` is in `--allowedTools` for every claude
 invocation regardless of tool groups.
@@ -96,7 +96,7 @@ The bash tooling follows the same daemon + stdio-bridge pattern as the
 matrix MCP:
 
 - **`hive-bash-daemon`** — long-running process (one per agent container,
-  systemd service in `harness-base.nix`). Owns subprocess management,
+  systemd service in `nix/agent-modules/mcp.nix`). Owns subprocess management,
   output file writing, `mcp-loose-ends/` state, and wake signal delivery.
   Listens on `/run/hive-bash/socket` inside the container.